DPO and compliance
Map data flows, legal-operational handoffs, control ownership, and evidence gaps before a regulator or customer review.
01Assessment
PDPL Controls & Evidence Readiness Assessment
Use any AI model. Raw Saudi personal data stays in Saudi by default. PDPL controls built into the path.
Fixed fee: SAR 35,000 (VAT if applicable). SAR 17,500, non-refundable, reserves an agreed start date after the scope of work is signed. The remaining SAR 17,500 is due after factual validation and before the final report and executive readout are released. The 10-business-day clock starts when the first payment has cleared and the complete intake pack is accepted. Maximum two starts per month.
02Who it is for
Teams preparing AI workflows for PDPL enforcement scrutiny.
Security and engineering
Test whether the documented controls match the AI request path and whether retained evidence supports each claim.
Executives and risk owners
Get a risk-ranked view of what needs remediation, who should own it, and what should happen first.
03Inputs
Documents and safe review material only.
- One Saudi legal entity.
- Up to two priority personal-data or AI workflows.
- Four operational evidence domains: DPO accountability and ownership; 72-hour breach-reporting workflow; data-subject-request handling; and marketing consent and opt-out evidence.
- Maximum 12 supplied artifacts or 150 pages total.
- Two 60-minute stakeholder sessions.
- One consolidated clarification round.
- One factual-validation call.
- One executive readout.
- Documents plus synthetic or redacted material only.
- No client-system access and no production personal data.
Provide architecture and data-flow diagrams, policies, processing inventories, vendor and sub-processor lists, control descriptions, and existing evidence indexes.
Use synthetic or redacted material only. DataSitr does not access client systems and does not accept production personal data for this assessment.
Additional entities, workflows, or material are separately quoted. The 10-business-day clock starts once the booking payment has cleared and the complete intake pack is accepted.
04The 10 business days
A fixed path from intake to executive readout.
Days 1–2
Confirm scope, stakeholders, AI data flows, and the evidence index.
Days 3–7
Review technical and operational controls, map them to PDPL requirements, and rank gaps by risk.
Days 8–10
Validate findings, prioritize remediation, finalize the control map, and deliver the executive readout.
05Deliverables
Four artifacts your team can act on.
- Risk-ranked findings register with evidence references and named control owners.
- Control map to PDPL requirements, with implemented, partial, missing, and evidence-gap states.
- Prioritized remediation plan ordered by risk, dependency, and practical sequence.
- Executive readout covering material exposure, immediate decisions, and the next evidence gates.
07Boundaries
A technical and operational assessment, with explicit limits.
The assessment is not legal advice, a compliance determination, an audit, or a certification.
Controls are mapped to PDPL requirements; the assessment does not declare an organization compliant.
SDAIA application status: applied 2026-04-03, denied 2026-06-14, remediation and resubmission track
08Book
Book the PDPL Controls & Evidence Readiness Assessment.
SAR 35,000 · SAR 17,500 non-refundable to reserve the agreed start date · SAR 17,500 due before final-report release · 10 business days from accepted complete intake · VAT if applicable.